Who we are

Ideaworx is a venture studio and holding company. We operate this website, ideaworx.co, and an internal operations application at station.ideaworx.co (the "Control Station") that our own team uses to run the companies we hold. This policy covers both. It is written by the people who run them and it describes what the systems actually do.

The website

Visiting ideaworx.co collects the ordinary server logs any website collects: your IP address, browser type, the pages you view and when. We use these to keep the site running and to understand aggregate traffic. We do not run advertising trackers.

If you submit the request-access form, we receive the details you enter (name, email, organisation, and your message). We use them only to respond to you. They are stored in our operations application and are not sold, rented, or shared with anyone outside Ideaworx.

The Control Station

The Control Station is used only by Ideaworx operators, who sign in with an approved account. It holds operating information about our portfolio companies: findings from our own analysis, draft communications, tasks, and decisions. It is not offered to the public and does not create accounts for the public.

Google user data

Operators can connect a Google Workspace or Gmail mailbox that belongs to one of our companies. When you connect a mailbox, Google asks for your consent and we request these scopes:

• gmail.readonly to read messages in that mailbox
• gmail.send to send replies from it
• gmail.modify to mark messages as read

Here is precisely what happens with that access:

• We read recent inbox threads to show them to the operator and to help draft replies. Message content is read at the time it is displayed; for Google mailboxes we store thread metadata (subject, sender, snippet, date) and not full message bodies.
• We send an email only when an operator explicitly presses Send on a specific message. No email is ever sent automatically.
• The Google refresh token is stored encrypted at rest and is used only to perform the actions above for that mailbox.
• We do not use Google user data for advertising, we do not sell it, and we do not share it with third parties. Automated tools may summarise or draft on the basis of message content to assist the operator; no human other than Ideaworx operators reads it, and it is not used to train generalised models.

You can disconnect a mailbox at any time from inside the Control Station, or revoke access at myaccount.google.com/permissions. Disconnecting deletes the stored token immediately.

Email sent through our companies

Some of our companies receive and answer customer email through a transactional email provider (Resend). Messages you send to those company addresses are stored so that the company can reply to you and keep a record of the conversation. They are handled under that company's own privacy terms as well as this policy.

Service providers

We rely on a small number of providers to run these systems, each bound by its own terms: Render (hosting and databases), Clerk (sign-in for operators), Google (mailbox access, where connected), Resend (email delivery), and Anthropic (the AI models that assist our operators). Data is shared with them only to the extent needed to provide the service.

Retention and deletion

Website logs are kept for a short operational window and then discarded. Form submissions are kept for as long as we are in conversation with you. Mailbox tokens are deleted the moment a mailbox is disconnected. You can ask us to delete anything we hold about you by emailing hello@ideaworx.co; we will confirm when it is done.

Security

All traffic is encrypted in transit. Stored credentials are encrypted at rest. Access to the Control Station is limited to named operators. No system is perfect; if we ever learn of a breach affecting your information we will tell you.

Changes and contact

If this policy changes we will update the effective date at the top and, for material changes, note it on this page. Questions go to hello@ideaworx.co.